New York “Denies Access” to Employers Seeking Login Credentials for Employee’s Social Media Accounts

New York employers should take note:  2024 will bring significant changes in the state’s labor law, restricting the ability to seek login credentials for the private social media accounts of employees and job candidates. 

Specifically, beginning on March 12, 2024, employers in New York will be barred from “request[ing], requir[ing], or coerc[ing]” an employee or job applicant from providing their username and password to their private social media accounts. Similarly, under the new law, employers will be prohibited from accessing the accounts of employees whose login information they acquire in a prohibited manner, reproducing any images or information from the employee’s improperly accessed account, or taking any adverse action against an employee or applicant who refuses to provide their login credentials. 

The law is broad in its application — defining “employer” to mean all “person[s] or entit[ies] engaged in a business, industry, professional, trade or other enterprise in the state,” as well as any “agent, representative or designee of the employer.” 

While the law is a stringent and sweeping prohibition on an employer’s ability to gain access to employee social media accounts, there are certain limited exceptions. Among the exceptions, if an employer gives prior notice of its right to request such information, employers are still entitled to seek usernames and passwords for accounts that are provided by the employer and used by the employee for “business purposes,” or are business accounts used on an electronic device paid for (in whole or in part) by the employer. An employer also may seek login information from an employee if a court order so requires. 

Notably, nothing in the law prohibits an employee from voluntarily giving an employer (or a fellow employee) access to their social media accounts. And, once the employee provides such voluntary access, the employer may use the access to obtain photographs, video, messages, and information from the accounts, even if they obtain such information indirectly through a third-party intermediary (like a co-worker) to whom the employee provided authorized access. Of course, an employer’s access to a publicly available account is always permitted.  

While this new law is fairly comprehensive and detailed, some open questions remain and will need to be ironed out after it takes effect. For example, are employers of domestic workers included in the sweeping definition of “employer?” While it does not appear so from the explicit language of the definition, the rule’s stated justification would appear to cover all types of employers, including those who hire workers (like nannies and housekeepers) in their homes. In particular, the bill’s justification states that it seeks broadly to protect employees in New York from “unfair and discriminatory hiring [] practices” and to allow “people who do not have the option to walk away from a job” the means to resist the “severe invasion of privacy” that employers impose when they seek access to private social media accounts. Furthermore, determining when a social media account is, in fact, “used for business” may prove difficult, particularly when the account may be subject to mixed use. Finally, it seems inevitable that the exact contours of what constitutes an employee giving “voluntary access” will be tested. 

As we previously reported, many states have long since enacted laws prohibiting employers from seeking access to their employees’ social media accounts. Therefore, it seems likely that the interpretations of these other state rules may serve as a guide for New York. Time will tell.    For the moment, employers are well-advised to have counsel review and modify their social media policies and recruitment practices to ensure that they do not improperly seek access to their employees’ or job applicants’ private social media accounts. Further, to the extent employers pay for and provide electronic communication devices to their employees, they must be careful to explicitly condition acceptance of those devices by the employees on access to social media accounts used for business purposes.